Insecure Cross-Origin Resource Sharing Policy in HCL iControl
CVE-2026-66247

4.3MEDIUM

Key Information:

Vendor

HCL Software Software

Status
Icontrol
Vendor
CVE Published:
1 October 2026

What is CVE-2026-66247?

HCL iControl is susceptible to an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability that permits malicious websites to initiate cross-origin requests with user credentials. This flaw could potentially enable attackers to gain unauthorized access to sensitive information within the context of an active user session, leading to severe data exfiltration risks.

Affected Version(s)

iControl v4.5.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.